What problem does it solve? AI agents need distinct, auditable identities with independently scoped permissions, but standard Entra app registrations cannot provide per-instance identities or the specialized token flows agents require. This Skill guides provisioning of Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities through Microsoft Graph, plus the two-step fmi_path token exchange for autonomous and on-behalf-of authentication. ## Core Features & Use Cases - Identity Provisioning: Create Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities using typed Microsoft Graph endpoints in PowerShell or Python. - Runtime Token Exchange: Implement the two-step fmi_path exchange for autonomous (app-only) and OBO (delegated) flows, including cross-tenant scenarios. - Polyglot Sidecar Deployment: Deploy the Microsoft Entra SDK for AgentID sidecar container so Python, Node, Go, and Java agents acquire tokens over HTTP without SDK embedding. - Use Case: You are building a fleet of support agents that each need their own identity and audit trail. Use this Skill to create one Blueprint, provision an Agent Identity per instance, grant per-agent Graph permissions, and wire up Managed Identity + Workload Identity Federation for production token acquisition. ## Quick Start Ask the AI to create an Agent Identity Blueprint and BlueprintPrincipal in your tenant, then provision a per-instance Agent Identity and show the fmi_path token exchange code to acquire a Graph token for it.
